help
CommandShow available THRUNT threat hunting commands and artifact layout
Archive completed milestone and prepare for next version
type: prompt name: thrunt:complete-milestone description: Archive completed milestone and prepare for next version argument-hint: <version> allowed-tools: - Read - Write - Bash
<objective> Mark milestone {{version}} complete, archive to milestones/, and update HUNTMAP.md and HYPOTHESES.md.
Purpose: Create historical record of published version, archive milestone artifacts (huntmap + requirements), and prepare for next milestone. Output: Milestone archived (huntmap + requirements), MISSION.md evolved, git tagged. </objective>
<execution_context> **Load these files NOW (before proceeding):**
</execution_context>
<context> **Project files:**
**User input:**
</context>
<process>
**Follow complete-milestone.md workflow:**
0. **Check for audit:**
## Pre-flight Check
{If no v{{version}}-MILESTONE-AUDIT.md:}
⚠ No milestone audit found. Run `/thrunt:audit-milestone` first to verify
requirements coverage, cross-phase integration, and E2E flows.
{If audit has gaps:}
⚠ Milestone audit found gaps. Run `/thrunt:plan-milestone-gaps` to create
phases that close the gaps, or proceed anyway to accept as tech debt.
{If audit passed:}
✓ Milestone audit passed. Proceeding with completion.1. **Verify readiness:**
2. **Gather stats:**
3. **Extract accomplishments:**
4. **Archive milestone:**
5. **Archive requirements:**
6. **Update MISSION.md:**
7. **Commit and tag:**
8. **Offer next steps:**
</process>
<success_criteria>
</success_criteria>
<critical_rules>
</critical_rules>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…